Remove 1 field from syslog before sending to Splunk Cloud?

[JChris_]

I have a system X that sends syslog to a Splunk HF which then sends to Splunk Cloud.

The syslog contains the same data in the fields msg and desc, so I'd like to remove the field desc in Splunk HF before sending the syslog. How can I do that?

I thought about using transforms.conf and props.conf (https://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Discard_specific_e...), but this is used for dropping the entire log.

[diogofgm · Accepted solution]

You can use props and transforms to remove the desc part without dropping the entire log. You need to build a good regex in order to "select" and remove just the bits you want. This is also used in case you need to anonymise any part of your data before indexing it to splunk. In your case instead of replacing said data with "xxxx" you can replace it with nothing.

Check this example:
https://community.splunk.com/t5/Getting-Data-In/Anonymize-Data-in-Splunk-Search/m-p/238539

[JChris_]

Thanks, that's exactly what I end up doing after I posted this thread xD